Skip to content
Experiencing a breach? Get help now
Cyberphore
Services
Industries
Locations
Resources
Company
Talk to an expertExperiencing a breach?

Vulnerability management

Thousands Of Flaws.Fix The Ten That Matter.

Thousands of findings, ranked by what attackers are actually exploiting, so your team fixes the few that matter first. We can apply the patches for you too.

Book my free assessmentSee how it works
External scans
Weekly
Internal scans
Monthly
Cloud scanning
Continuous
CONSOLE00:00:00 ET3MT

Exposure / Vulnerabilities

Exposure trend

Sample data

Certified partner of

Why this cannot wait

Median time to fully fix a known exploited vulnerability
43 days
Verizon, Data Breach Investigations Report, 2026
Critical (CISA KEV) vulnerabilities fully remediated in 2025
26%
Verizon, Data Breach Investigations Report, 2026
Breaches that began with exploitation, now ahead of stolen credentials
31%
Verizon, Data Breach Investigations Report, 2026

Overview

Thousands of Findings. A Short List That Gets Fixed

Vulnerability management is the continuous process of finding, prioritizing, fixing and verifying security weaknesses across everything your business runs: laptops, servers, network devices, cloud accounts, websites and the services you expose to the internet. It is not a single scan. It is a cycle that runs every week, because new vulnerabilities are published every week.

Any scanner will give you thousands of findings. Cyberphore uses AI and threat intelligence to cut them down to a short list, has analysts confirm the priorities and tracks every fix with your IT team until it is closed.

Who Needs Vulnerability Management

  • A Lethbridge agri-food processorA mix of new and decade-old servers, with one IT generalist.
  • A Markham technology companyCustomers ask for evidence of regular scanning in security questionnaires.
  • A Surrey property management firmHas never been sure exactly how many devices it owns.
  • Any business with an insurance form to answerAsked how quickly it patches critical issues, and did not know.

When a lighter approach is enough: fewer than 20 devices, all managed through Microsoft Intune with automatic updates, no on-premises servers and nothing exposed to the internet except Microsoft 365. Quarterly external scanning and a periodic review of device update compliance may do. We will say so.

Asset discovery and scanning

You Cannot Patch a Server Nobody Knows About

Old test systems, forgotten cloud instances and devices installed by vendors are common entry points. So discovery comes first, and scanning is set up to produce results your team can trust.

One Inventory, Built from Four Sources

  • Network scans
  • Device management tools
  • Cloud accounts
  • DNS records

Asset inventory

Maintained by us, reviewed with you, with the assets that matter most agreed up front.

Four Layers of Scanning

Scanning with Tenable or Qualys

  • External attack surfaceWhat your business exposes to the internet: domains, services and remote access. The part an attacker sees first.

    How often: Continuous

  • Internal, authenticatedCredentialed scans of workstations and servers, for accurate results with fewer false positives.

    How often: On a set schedule

  • Cloud accountsConfiguration and vulnerability checks across your cloud environments.

    How often: Continuous

  • Web applicationsVulnerability checks for the web applications you run.

    How often: Agreed at scoping

Fragile Systems Are Handled with Care

Some industrial controllers, medical devices and legacy applications react badly to active scans. We identify them during onboarding.

  • Exclude them
  • Scan them gently
  • Use passive methods

Risk-based prioritization

Why a Severity Score Alone Sends Your Team to the Wrong Fix

The CVSS score measures how bad a flaw could be in theory. It does not tell you whether attackers are using it right now, or whether the affected system is on the internet.

Sample findings
  1. 1

    Print serverPrivilege escalation

    CVSS criticalInternal onlyNo known exploit

  2. 2

    Test machineOutdated component

    CVSS criticalIsolatedNo known exploit

  3. 3

    File serverRemote code execution

    CVSS highPublic exploitSensitive data

  4. 4

    VPN applianceRemote access flaw

    CVSS mediumInternet-facingOn CISA KEV

Ranked by CVSS alone, the VPN flaw attackers are using right now comes last.

Five Questions Asked of Every Finding

Automation enriches each finding with threat intelligence and what we know about the asset.

  1. Is there a public exploit?
  2. Is it on CISA’s Known Exploited Vulnerabilities catalogue?
  3. Has the Canadian Centre for Cyber Security issued an alert?
  4. Is the asset internet-facing?
  5. Does the asset hold sensitive data?

Then a person decides. An analyst reviews the result, removes false positives and confirms the short list before it reaches your team.

Remediation tracking

Every Priority Finding Gets an Owner, a Deadline and a Rescan

The usual failure is simple: findings land in a report, the report lands in an inbox, and nothing happens. We work with your internal IT team or managed IT provider until each fix is verified.

Cyberphore

  • Find and confirm each weakness, removing false positives
  • Rank by real risk and write clear fix instructions
  • Agree an owner and a risk-based deadline for every priority finding
  • Follow up, then rescan to verify the fix
  • Call you directly when a newly exploited flaw affects something you run

Your IT Team or IT Provider

  • Apply patches and configuration changes on the systems you manage day to day
  • Retire or isolate end-of-life systems, following the agreed plan

Prefer us to apply some fixes? Cyberphore can also deploy patches as a managed service. We agree it during scoping.

CONSOLE00:00:00 ET3MT

Exposure / Remediation

Remediation tracker

Sample data

How Fast Should It Be Fixed? It Depends on Exposure and Exploitation

We help you set realistic remediation timelines by risk level during onboarding, then hold everyone to them.

  • Internet-facing, such as a firewall, VPN or file transfer product · Actively exploited

    Days, sometimes hours

    We flag it directly instead of waiting for the monthly report.

  • Internet-facing, such as a firewall, VPN or file transfer product · No known exploit

    Agreed timeline

    Set with you by severity and exposure.

  • Internal only · Actively exploited

    Agreed timeline

    Set with you by severity and exposure.

  • Internal only · No known exploit

    Your normal patch cycle

    Usually fine for internal issues with no known exploit.

Reporting and trends

A Monthly Report Your IT Provider Can Act on and Your Insurer Can Read

It fits on a few pages and answers the questions leadership and IT actually ask. If a report needs a security specialist to interpret, it is not doing its job.

Monthly Vulnerability Report

Outline
  1. 01HeadlineOverall risk trend this month, in one or two sentences
  2. 02Urgent itemsActively exploited or internet-facing issues and their status
  3. 03Overdue fixesWhat is past its agreed deadline, who owns it and why it is late
  4. 04New assetsDevices or services discovered that were not in the inventory
  5. 05End-of-life systemsSoftware or hardware no longer receiving security updates
  6. 06ProgressFindings opened and closed, by severity, over the last six months

Appendix: the full technical detail, written for your IT provider.

What to look for over time: not zero findings (that never happens), but a falling trend line and steady progress.

Canadian Considerations

The same records serve as evidence for insurers, auditors and customers.

  • Government Guidance

    The Canadian Centre for Cyber Security publishes alerts on actively exploited vulnerabilities and includes patching in its baseline controls for small and medium organizations. CyberSecure Canada certification also expects timely patching. Cyber Centre alerts are one of our prioritization inputs.

  • Cyber Insurance

    Applications commonly ask how quickly you patch critical vulnerabilities, whether you scan regularly and whether end-of-life systems remain. A documented program helps you answer accurately. Your insurer decides coverage and premiums.

    Cyber insurance readiness

  • Compliance Frameworks

    SOC 2, ISO 27001 and PCI DSS all expect a working vulnerability management process. PCI DSS specifies quarterly internal and external scans for in-scope systems.

    Compliance readiness

General information, not legal or insurance advice.

Versus penetration testing

Scanning Catches New Issues Between Tests. Testing Shows What Scanners Miss

They complement each other. A vulnerability assessment is a point-in-time scan and report. Vulnerability management is the continuous program around it that keeps you where the assessment says you are.

Question it answers
Vulnerability managementWhich known weaknesses exist across everything we run, and which matter most?
Penetration testWhat could an attacker actually do by exploiting and chaining weaknesses together?
Breadth and depth
Vulnerability managementYour whole environment, at scale
Penetration testA defined scope, in depth
Rhythm
Vulnerability managementA continuous program
Penetration testA periodic exercise
What you get
Vulnerability managementA ranked fix list, owners, verification and monthly trend reports
Penetration testA report showing real impact, including what scanners miss

Questions to Ask Any Vulnerability Management Provider

  1. 1How do you prioritize?If the answer is “by CVSS score”, keep looking.
  2. 2Does a person review findings before we see them?Ours do. An analyst removes false positives and confirms the short list.
  3. 3Do you discover unknown assets?Or do you only scan the IP ranges we give you?
  4. 4How do you handle fragile systems?Industrial controllers, medical devices and legacy applications need care.
  5. 5Can we see a sample monthly report?Judge whether your IT provider would know exactly what to do with it.

How the engagement runs

A Cycle That Repeats, Because New Vulnerabilities Arrive Every Week

  1. 1DiscoverInventory internet-facing, internal and cloud assets, and agree which matter most.
  2. 2ScanScheduled authenticated and external scans, plus continuous attack surface checks.
  3. 3PrioritizeAI-assisted analysis and analyst review rank findings by real risk and assign owners.
  4. 4Track and reportFollow fixes to closure and report monthly on what was fixed, what remains and why.

Then back to step 1. Between cycles, when a newly exploited flaw affects something you run, we contact you directly.

CONSOLE00:00:00 ET3MT

Exposure / Prioritization

This week’s short list

Sample data

What Drives the Cost of Vulnerability Management

Pricing is usually per asset or per IP address, per month, and depends on your environment and scope. The cheapest option is rarely a scanner licence on its own. It is the program that gets fixes done.

  • Internal assets in scope
  • External IP addresses and domains
  • Cloud accounts
  • Web applications
  • Scan frequency
  • How much hands-on remediation support you want

FAQ

Vulnerability Management: Common Questions

What is the difference between a vulnerability assessment and vulnerability management?

A vulnerability assessment is a point-in-time scan and report. Vulnerability management is the continuous program around it: discovering assets, scanning regularly, prioritizing, assigning fixes, verifying they happened and reporting on progress. An assessment tells you where you stand today. Management keeps you there as new vulnerabilities are published every week.

How is this different from a penetration test?

Vulnerability management finds and ranks known weaknesses across your whole environment, frequently and at scale. A penetration test is a deeper, periodic exercise where testers exploit weaknesses and chain them together to show real impact. They complement each other. Scanning catches new issues between tests, and testing shows what the scanner misses.

How fast should we patch critical vulnerabilities?

It depends on exposure and exploitation. A flaw in an internet-facing firewall or VPN that is being actively exploited should be addressed in days, sometimes hours. An internal issue with no known exploit can usually follow your normal patch cycle. We help you set realistic timelines by severity and exposure, and we flag the urgent ones directly.

Who actually applies the patches?

Usually your internal IT team or managed IT provider, because they manage the systems day to day. We find, prioritize, explain and verify. If you would like us to apply certain fixes, we can discuss it during scoping. The important thing is that every finding has a named owner and a due date. Cyberphore can also deploy patches for you as a managed service.

Will scanning disrupt our systems?

Modern scanning is generally safe for standard workstations, servers and cloud services. Older or fragile systems, such as some industrial controllers, medical devices or legacy applications, can react badly to active scans. We identify those during onboarding and either exclude them, scan them gently or use passive methods instead.

Do insurers ask about vulnerability management?

Often, yes. Canadian cyber insurance applications commonly ask how quickly you patch critical vulnerabilities, whether you scan regularly and whether any end-of-life systems remain in use. A documented program with monthly reports makes those answers easy and accurate. Your insurer decides coverage and premiums.

Get started

See What You Expose and What to Fix First

A free 30-minute scoping call with a certified specialist. We talk through what you run, what is exposed to the internet and whether a full program or a lighter approach fits.

  1. 1Free scoping callAssets in scope, fragile systems to treat with care, and who owns fixes today.
  2. 2Written quote in CADBased on your assets, IP addresses, cloud accounts and web applications.
  3. 3OnboardingDiscovery, first scans and agreed remediation timelines. Most clients are onboarded in 1 to 2 weeks.
Incident happening now? Call 24/7: +1 236 665 1165

Book Your Free Scoping Call

Free, 30 minutes, no obligation.

Related Services

Penetration TestingManual, scoped testing of networks, web applications, APIs, cloud and people, with reports your executives and engineers can both use.Endpoint SecurityManaged EDR, hardening and device controls for laptops, desktops, servers and mobile devices, monitored around the clock.Network and Firewall SecurityFirewall management, secure remote access, segmentation and network monitoring for offices, plants, clinics and job sites.
Guides:Penetration Testing Cost in Canada: What Drives the Price

From the blog

Latest Analysis on This Topic

All articles
Book free assessment